Apache Web Server Hardening Guide

#Security Hardening Overview

This guide implements advanced security measures to protect your Apache web server against common threats and vulnerabilities.

11

Security Steps

~60

Minutes

Advanced

Difficulty

Production

Ready

#Before You Begin - Critical Security Notes

• Backup: Create full system and configuration backups before proceeding
• Testing: Test all configurations in a staging environment first
• SSL Certificates: Have valid SSL certificates ready for HTTPS configuration
• Access: Ensure you have alternative access methods (console, KVM) in case of lockout
• Documentation: Document all changes made for future reference
• Monitoring: Have monitoring tools ready to detect issues after hardening

#Hide Apache Version and OS Information 5 minutes

Command
                        Copy
                    
                    sudo nano /etc/apache2/conf-available/security.conf

Configuration
                        Copy
                    
                    ServerTokens Prod
ServerSignature Off

Prevent Apache from revealing version and OS information in HTTP headers and error pages

Security Impact: Hiding server information makes it harder for attackers to identify specific vulnerabilities in your Apache version.

#Disable Unnecessary Modules 3 minutes

Commands
                        Copy
                    
                    sudo a2dismod status
sudo a2dismod info
sudo a2dismod autoindex
sudo a2dismod userdir
sudo a2dismod cgi

Disable Apache modules that are not needed to reduce attack surface

Security Impact: Each enabled module increases the potential attack surface. Only enable modules that are absolutely necessary.

#Configure Secure HTTP Headers 10 minutes

Enable Module
                        Copy
                    
                    sudo a2enmod headers

Create Configuration
                        Copy
                    
                    sudo nano /etc/apache2/conf-available/security-headers.conf

Security Headers Configuration
                        Copy
                    
                    Header always set X-Content-Type-Options nosniff
Header always set X-Frame-Options DENY
Header always set X-XSS-Protection "1; mode=block"
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Content-Security-Policy "default-src 'self'"

Enable Configuration
                        Copy
                    
                    sudo a2enconf security-headers

Add security headers to protect against common web vulnerabilities

Security Impact: Security headers provide additional protection against XSS, clickjacking, MIME sniffing, and other attacks.

#Restrict Access to Root Directory 5 minutes

Edit Configuration
                        Copy
                    
                    sudo nano /etc/apache2/apache2.conf

Root Directory Configuration
                        Copy
                    
                    <Directory />
    Options None
    AllowOverride None
    Require all denied
</Directory>

Secure the root directory to prevent unauthorized access

Security Impact: This configuration ensures that the root directory is completely locked down by default.

#Configure Secure Document Root 5 minutes

Edit Site Configuration
                        Copy
                    
                    sudo nano /etc/apache2/sites-available/000-default.conf

Document Root Configuration
                        Copy
                    
                    <Directory /var/www/html>
    Options -Indexes -Includes -ExecCGI
    AllowOverride None
    Require all granted
</Directory>

Secure the document root directory with restrictive permissions

Security Impact: Removes dangerous options like directory listing, includes, and CGI execution from the web root.

#Implement Rate Limiting 8 minutes

Install mod_evasive
                        Copy
                    
                    sudo apt install libapache2-mod-evasive -y

Enable Module
                        Copy
                    
                    sudo a2enmod evasive

Configure mod_evasive
                        Copy
                    
                    sudo nano /etc/apache2/mods-available/evasive.conf

Rate Limiting Configuration
                        Copy
                    
                    DOSHashTableSize    2048
DOSPageCount        2
DOSPageInterval     1
DOSSiteCount        50
DOSSiteInterval     1
DOSBlockingPeriod   600

Install and configure mod_evasive to prevent DoS attacks

Security Impact: mod_evasive helps protect against DoS and DDoS attacks by limiting requests per page and site.

#Configure SSL/TLS Security 10 minutes

Enable SSL Module
                        Copy
                    
                    sudo a2enmod ssl

Configure SSL
                        Copy
                    
                    sudo nano /etc/apache2/mods-available/ssl.conf

SSL/TLS Configuration
                        Copy
                    
                    SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder On
SSLSessionTickets Off
SSLUseStapling On
SSLStaplingCache "shmcb:logs/stapling-cache(150000)"

Configure strong SSL/TLS encryption and disable weak protocols

Security Impact: This configuration ensures only secure TLS versions and strong ciphers are used.

#Limit Request Size and Timeouts 5 minutes

Create Limits Configuration
                        Copy
                    
                    sudo nano /etc/apache2/conf-available/limits.conf

Limits Configuration
                        Copy
                    
                    LimitRequestBody 10485760
LimitRequestFields 40
LimitRequestFieldSize 8190
LimitRequestLine 4094
Timeout 60
KeepAliveTimeout 5

Enable Configuration
                        Copy
                    
                    sudo a2enconf limits

Set limits on request size and timeouts to prevent resource exhaustion

Security Impact: These limits help prevent resource exhaustion attacks and improve server performance.

#Configure Log Security 5 minutes

Create Log Configuration
                        Copy
                    
                    sudo nano /etc/apache2/conf-available/log-security.conf

Logging Configuration
                        s %O \\\"%{Referer}i\\\" \\\"%{User-Agent}i\\\"\" combined_security\nCustomLog ${APACHE_LOG_DIR}/access.log combined_security\nErrorLog ${APACHE_LOG_DIR}/error.log\nLogLevel warn', this)">Copy
                    
                    LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined_security
CustomLog ${APACHE_LOG_DIR}/access.log combined_security
ErrorLog ${APACHE_LOG_DIR}/error.log
LogLevel warn

Enable Configuration
                        Copy
                    
                    sudo a2enconf log-security

Configure secure logging with proper format and level

Security Impact: Proper logging is essential for security monitoring and incident response.

#Set Proper File Permissions 3 minutes

Set File Permissions
                        Copy
                    
                    sudo chown -R root:root /etc/apache2/
sudo chmod -R 644 /etc/apache2/
sudo chmod -R +X /etc/apache2/
sudo chown -R www-data:www-data /var/www/
sudo chmod -R 755 /var/www/

Set secure file and directory permissions for Apache configuration and web content

Security Impact: Proper file permissions prevent unauthorized access to configuration files and web content.

#Enable and Test Configuration 2 minutes

Test and Apply Configuration
                        Copy
                    
                    sudo a2enconf security
sudo apache2ctl configtest
sudo systemctl reload apache2

Enable security configurations and test Apache configuration

Security Impact: Always test configuration changes before applying them to ensure Apache starts correctly.

#Apache Hardening Complete!

Your Apache web server is now significantly more secure against common attacks and vulnerabilities.

Next Steps: Implement monitoring, regular security audits, and keep your system updated.

#Security Monitoring Tools

Essential tools for ongoing security monitoring and threat detection

fail2ban

Install Command
                            Copy
                        
                        sudo apt install fail2ban -y

Config: /etc/fail2ban/jail.local

Automatically ban IPs that show malicious behavior

logwatch

Install Command
                            Copy
                        
                        sudo apt install logwatch -y

Daily log analysis and reporting tool

rkhunter

Install Command
                            Copy
                        
                        sudo apt install rkhunter -y

Rootkit detection and system security scanner

#Ongoing Maintenance Tasks

Regular security maintenance to keep your hardened Apache server secure

Regular Updates Weekly

Command
                            Copy
                        
                        sudo apt update && sudo apt upgrade apache2 -y

Keep Apache and system packages updated

Log Review Daily

Command
                            Copy
                        
                        sudo tail -f /var/log/apache2/error.log

Monitor error logs for suspicious activity

SSL Certificate Check Monthly

Command
                            Copy
                        
                        sudo openssl x509 -in /path/to/cert.pem -noout -dates

Verify SSL certificate expiration dates

Security Scan Weekly

Command
                            Copy
                        
                        sudo rkhunter --check

Run security scans to detect vulnerabilities